registry / getlib-mcp / 1.1.6

getlib-mcp@1.1.6

⚠ Under review

GetLib MCP - powerful modular self-hostable library docs MCP server and dashboard (Context7 alternative)

Static Scan Results

scanned 28d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 1.88 MB of source, external domains: 10play.github.io, actix.rs, ai-sdk.dev, ai.google.dev, ai.pydantic.dev, airflow.apache.org, alamofire.github.io, alembic.sqlalchemy.org, alpinejs.dev, angular.dev, animejs.com, ant.design, api.github.com, appandflow.github.io, appwrite.io, aquasecurity.github.io, argo-cd.readthedocs.io, ariakit.org, arktype.io, authjs.dev, auto-animate.formkit.com, axiom.co, axios-http.com, bandit.readthedocs.io, bcd.developer.mozilla.org, bevyengine.org, biomejs.dev, black.readthedocs.io, bun.sh, caddyserver.com, caniuse.com, capacitorjs.com, cheatsheetseries.owasp.org, cheerio.js.org, clerk.com, clickhouse.com, cloud.google.com, cmdk.paco.me, cobra.dev, code.claude.com, codemirror.net, conform.guide, console.groq.com, content-security-policy.com, content.nuxt.com, contentlayer.dev, css-tricks.com, cva.style, d3js.org, daisyui.com

Source & flagged code

6 flagged

dist/mcp.jsView file

244`),c={projectPath:t,filesScanned:r,totalIssues:s.length,uniqueIssueTypes:n.size,issues:Array.from(n.entries()).map(([u,d])=>({title:u,severity:d[0]?.severity,category:d[0]?.categor... L245: `,structuredContent:{...c,totalIssues:0,uniqueIssueTypes:0,issues:[]}};let l=Array.from(n.entries()).map(([u,d])=>Eke(u,d,o)).join("");return{text:a+l,structuredContent:c}}async fu... L246: `,r);r=n===-1?e.length:n;continue}if(s==="/"&&e[r+1]==="*"){let n=e.indexOf("*/",r+2),o=n===-1?e.length-1:n+1;t.push([r,o]),r=o+1;continue}r++}return new TJ(t)}async function UJ(e,...

High

Child Process

Package source references child process execution.

dist/mcp.jsView on unpkg · L244

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp.js: import{createRequire as fre}from"node:module";var ure=Object.create;var{getPrototypeOf:dre,defineProperty:Bd,getOwnPropertyNames:ER}=Object;var kA=Object.prototype.hasOwnProperty;f... `),()=>this.onerror("timeout"),(n)=>{if(!n||n.status!==200)this.awaitingBatchAck=!1,this.onerror(n&&n.status),this.closeAndRetry(1011,"internal server error",!1);else if(r<e.length... });`;class DP{get endPoint(){return this.socketAdapter.endPoint}get timeout(){return this.socketAdapter.timeout}get transport(){return this.socketAdapter.transport}get heartbeatCal... \r=`.split(""),Joe=(()=>{let e=Array(128);for(let t=0;t<e.length;t+=1)e[t]=-1;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp.jsView on unpkg

229L230: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let i of e.seen.entries()){let a=i[1];if(t===i[0]){o(i);continue}if(e.external){let l=e.exter... L231: ... L244: `),c={projectPath:t,filesScanned:r,totalIssues:s.length,uniqueIssueTypes:n.size,issues:Array.from(n.entries()).map(([u,d])=>({title:u,severity:d[0]?.severity,category:d[0]?.categor... L245: `,structuredContent:{...c,totalIssues:0,uniqueIssueTypes:0,issues:[]}};let l=Array.from(n.entries()).map(([u,d])=>Eke(u,d,o)).join("");return{text:a+l,structuredContent:c}}async fu... L246: `,r);r=n===-1?e.length:n;continue}if(s==="/"&&e[r+1]==="*"){let n=e.indexOf("*/",r+2),o=n===-1?e.length-1:n+1;t.push([r,o]),r=o+1;continue}r++}return new TJ(t)}async function UJ(e,...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp.jsView on unpkg · L229

229Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/mcp.js L229: L230: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let i of e.seen.entries()){let a=i[1];if(t===i[0]){o(i);continue}if(e.external){let l=e.exter... L231: ... L244: `),c={projectPath:t,filesScanned:r,totalIssues:s.length,uniqueIssueTypes:n.size,issues:Array.from(n.entries()).map(([u,d])=>({title:u,severity:d[0]?.severity,category:d[0]?.categor... L245: `,structuredContent:{...c,totalIssues:0,uniqueIssueTypes:0,issues:[]}};let l=Array.from(n.entries()).map(([u,d])=>Eke(u,d,o)).join("");return{text:a+l,structuredContent:c}}async fu... L246: `,r);r=n===-1?e.length:n;continue}if(s==="/"&&e[r+1]==="*"){let n=e.indexOf("*/",r+2),o=n===-1?e.length-1:n+1;t.push([r,o]),r

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/mcp.jsView on unpkg · L229

163patternName = generic_password severity = medium line = 163

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mcp.jsView on unpkg · L163

178L179: `),t=t.split(String.fromCharCode(8212)).join("-"),t}class dw{active=0;queue=[];max;constructor(e){this.max=e}async acquire(){if(this.active<this.max){this.active++;return}return ne... L180: `).filter((o)=>o),s=Math.min(...r.map((o)=>o.length-o.trimStart().length)),n=r.map((o)=>o.slice(s)).map((o)=>" ".repeat(this.indent*2)+o);for(let o of n)this.content.push(o)}compil...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L178

getlib-mcp@1.1.6

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code